Reference Guide

Navigate the Dell Server
92
• Data Guardian Action - The default is All. Click one or more check boxes to display the
reason for an Action. See Protected_Office_Document_audit_events
and the tables below
for details and to determine the operating system.
• Net Action (Cloud Encryption - Windows only) - Identifies attempts by a user or device to
open an application or browser, but the attempt was blocked; or, attempts to proxy
through, but the address was blocked. See Net Action
.
• Grouping - Allows you to select one option. The default is None. Here are some examples:
• Moniker - Groups by moniker if you have more than one selected.
• Device or User - Allows you to determine the activity of specific devices or users.
• File Name, File Path or File KeyID - With Device and User columns added, allows you to see
which users or devices accessed a file.
• Columns - Filter the amount of data by selecting one or multiple columns to display. If you clear all
column check boxes, audit events are listed for all endpoints and all users. Some filters apply to all
monikers and some to specific monikers. For a description of column filters, see
Options in the
Columns dropdown.
• Search field - Enter text, and the search includes Device, User, File Name, and File KeyID. Use a
wildcard (*) to search on .docx, .pptx, .xlsx, .docm, .pptm, .xlsm, or .pdf.
• Export File - Export to Excel or a .csv file.
Options in the Columns dropdown
Options can apply to all monikers or to a specific moniker. Policies must be enabled for audit data to
display.
Search icons in the columns - If you click the Search icon next to an item in the Device, User, File Name, or
KeyID columns, it copies the cell content to the Search field and executes a search on that content. You can
then select Action or IP address to do additional filtering.
Column options for all audit events
Audit Event
- Column options Description
Moniker
- Select one or more. Category of the audit event:
• Cloud Encryption
• Protected Office
• System
• Beacon
Device
The host name of the device where the event occurred.
User
User associated with the event.
Note: Typically, this is the email address of the activated user. However, for manual
activations or external users, the login name and email address used to activate against the
Server may differ. If you do not recognize the User name, open the log files to view the
logged-in user name.
• In the log file for Cloud Encryption, information displays as sl_xen_file.
• In the log file for Protected Office, information displays as sl_protected_file.
Timestamp
Date and time when the event occurred.
Created
Date and time when the Dell Server created the entry in the database. View this if a delay
occurs.